EAP-TLS - About username sent by supplicant
Hello, I use EAP-TLS to authenticate the computers on my wlan. As the supplicants run on Windows XP, I had to store the certificates in the 'local computer' and 'user account' stores and create the register key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global\AuthMode with the value '1' (dword). You may ask me why. The reason is simple. Certificates stored in 'local computer' are used at boot time and certiticates store in 'user account' and used at login time. The value of the register key tells Windows to authenticate at boot time and after login time. So, if the WIFI card is removed and inserted, the authentication works fine. :) My question deals with the username sent by the supplicant when the authentication goes on. At boot time, the username sent is : host/user_name. After the login, the username sent is : user_name. So, I have to create 2 users. I want to cut 'host/' to make this task easier. It is possible ? How do I do this ? Regards, ---------------------------------------- Patrice OLIVER Chef du Projet Ville Hôpital Responsable Réseaux & Sécurité ---------------------------------------- HOSPICES CIVILS DE BEAUNE Service Informatique BP 104 21203 BEAUNE CEDEX Tél. 33 3 80 24 44 09 Fax 33 3 80 24 45 90 ----------------------------------------
Hi,
My question deals with the username sent by the supplicant when the authentication goes on. At boot time, the username sent is : host/user_name. After the login, the username sent is : user_name. So, I have to create 2 users. I want to cut 'host/' to make this task easier. It is possible ? How do I do this ?
attr_filter or somesuch eg put these into radiusd.conf attr_rewrite copy-user-name { attribute = Stripped-User-Name new_attribute = yes searchfor = "" searchin = packet replacewith = "%{User-Name}" } attr_rewrite remove-host { attribute = Stripped-User-Name searchfor = "^(host/.*)" searchin = packet new_attribute = no replacewith = "%{1}" } and then call these 2 functions in your authorize section (radiusd.conf or sites-enabled/wherever (for FR 2.0) ) copy-user-name remove-host just before the other modules are called - eg chap, auth_log etc etc alan
Hello, It works, thanks. :) Regards. -----Original Message----- From: A.L.M.Buxey@lboro.ac.uk To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Date: Fri, 14 Dec 2007 09:39:08 +0000 Subject: Re: EAP-TLS - About username sent by supplicant
Hi,
My question deals with the username sent by the supplicant when the authentication goes on. At boot time, the username sent is : host/user_name. After the login, the username sent is : user_name. So, I have to create 2 users. I want to cut 'host/' to make this task easier. It is possible ? How do I do this ?
attr_filter or somesuch eg put these into radiusd.conf
attr_rewrite copy-user-name { attribute = Stripped-User-Name new_attribute = yes searchfor = "" searchin = packet replacewith = "%{User-Name}" }
attr_rewrite remove-host { attribute = Stripped-User-Name searchfor = "^(host/.*)" searchin = packet new_attribute = no replacewith = "%{1}" }
and then call these 2 functions in your authorize section (radiusd.conf or sites-enabled/wherever (for FR 2.0) )
copy-user-name remove-host
just before the other modules are called - eg chap, auth_log etc etc
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
A.L.M.Buxey@lboro.ac.uk -
OLIVER Patrice